How does codeigniter's form validation library handle xss filtering?

Question

The codeigniter form validation library provides the option to 'prep' data from a form that is being validated. The following is a snippet from the documentation:

$this->form_validation->set_rules('username', 'Username', 'trim|required|min_length[5]|max_length[12]|xss_clean');

The xss_clean parameter at the end supposedly passes the post data through the xss_clean function.

I am wondering how then do I use the POST data 'username'? Did the xss_clean function act directly on the POST variable so that I may then do: $username = $this->input->post('username'); and actually get the filtered data? What if I place that last statement before the validation line: will $username contain unfiltered data in this case? Thanks.

Answer 1

from the user guide

"If anything disallowed is encountered it is rendered safe by converting the data to character entities"

so yes, after running $this->input->post('username') through the form validation with the xss option set any dirty data will come out clean.

and yes, if you place that statement before the validation line it will not be cleaned.

note that you can run xss globally on all form submitted data so that you don't need to include it in your validation rules.

Answer 2

I would highly recommend looking through system/libraries/Input.php You can see exactly how the work is done in there.

I always recommend turning the global xss_clean on. There is very little impact on performance, unless you are not checking for xss on some fields, purposely.

Answer 3

The validation does xss clean, but it has nothing to do with $this->input->post('username'). That line right there will xss clean automatically, completely independent of your validation stuff (assuming you have global xss filtering on). As a matter of fact, I'm willing to bet that doing both will actually xss clean it twice, because I'm pretty sure that validation just creates a copy of the array..it doesn't actually modify $_POST.

But as I said, if you're accessing it by $this->input->post('username'), it will be cleaned regardless.